1d0128fd3184a765076397dd308e51bbc578a3639cb9c08ab6b5c36704d772b4

Resubmissions

14-11-2023 17:31

14-11-2023 17:21

28-10-2023 19:29

24-10-2023 13:29

18-10-2023 12:04

07-09-2023 12:10

max time kernel
30s
max time network
19s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-09-2023 12:10

Target

31860041f633899f97e48bcd189a406bdc37d6be297b3dd6431f446aff2852ff.exe
Size

603KB
MD5

386ad5036e95b8cbe06967ee2171114e
SHA1

c159cf6e8382231043060f647768987dec7505df
SHA256

31860041f633899f97e48bcd189a406bdc37d6be297b3dd6431f446aff2852ff
SHA512

5012595611c96f08cf729fac14a3c97417917cbdd18f581f306b65f28b4248d1c8a7ad003e2f1f7aa9695dacfaba18d641ac1f6db1da248be109c18accaa06fd
SSDEEP

12288:4xbFLS7NHbRobFSkfg+g3j0viyzQA9F67afYScr80O7Rf:4eRH+5w+o0vEwd0Q08Rf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2812	1284	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 2812	1284	31860041f633899f97e48bcd189a406bdc37d6be297b3dd6431f446aff2852ff.exe	28
PID 1284 wrote to memory of 2812	1284	31860041f633899f97e48bcd189a406bdc37d6be297b3dd6431f446aff2852ff.exe	28
PID 1284 wrote to memory of 2812	1284	31860041f633899f97e48bcd189a406bdc37d6be297b3dd6431f446aff2852ff.exe	28
PID 1284 wrote to memory of 2812	1284	31860041f633899f97e48bcd189a406bdc37d6be297b3dd6431f446aff2852ff.exe	28

C:\Users\Admin\AppData\Local\Temp\31860041f633899f97e48bcd189a406bdc37d6be297b3dd6431f446aff2852ff.exe
"C:\Users\Admin\AppData\Local\Temp\31860041f633899f97e48bcd189a406bdc37d6be297b3dd6431f446aff2852ff.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 284
  2⤵
  - Program crash
  PID:2812

memory/1284-1-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/1284-2-0x0000000000290000-0x00000000002D7000-memory.dmp

Filesize
284KB

Download
memory/1284-3-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/1284-4-0x00000000001B0000-0x00000000001BD000-memory.dmp

Filesize
52KB

Download
memory/1284-5-0x0000000000650000-0x00000000006CB000-memory.dmp

Filesize
492KB

Download
memory/1284-6-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1284-7-0x0000000000290000-0x00000000002D7000-memory.dmp

Filesize
284KB

Download
memory/1284-9-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1284-8-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download